{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:48:02Z","timestamp":1782809282607,"version":"3.54.5"},"reference-count":0,"publisher":"ECMS","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6,23]]},"abstract":"<jats:p>This article presents a systematic investigation of machine learning models for spam and phishing email detection, emphasising adversarial robustness and interpretability. Five classifiers\u2014Naive Bayes, Support Vector Machine, Logistic Regression, Dense Neural Network, and a zero-shot Large Language Model (ChatGPT GPT-4o-mini)\u2014are evaluated on a unified corpus of 176,367 messages (Enron-Spam, SpamAssassin, Phishing Email) for binary (ham vs. spam) and multi-class (ham vs. spam generic vs. phishing) classification.\n\nSix adversarial attack strategies are implemented: synonym replacement (WordNet, 45% rate, max 50 substitutions\/document), goodword injection (12 hamindicative words, 5 phrases), explanation- guided attack (novel SHAP-driven synonym replacement targeting top-25 influential tokens), character-level perturbations (homoglyphs, typos, leetspeak), rule-based paraphrase, and LLM-driven rewriting (GPT-4o-mini). Adversarial training and post-hoc interpretability methods (SHAP, LIME) are applied to examine defensive effectiveness and model transparency.\n\nExperimental findings reveal an accuracy-robustness gap: trained models achieve robust baseline performance (accuracy &gt;95% on clean data), yet all exhibit measurable vulnerability under attack. The zero-shot LLM reaches 89.2% accuracy (F1 0.896) on binary and 51% accuracy (macro F1 0.375) on multi-class without corpus-specific training. Binary F1 drops range from 0.39% (Logistic Regression) to 7.25% (Dense NN) depending on attack strategy. The LLM exhibits a striking paradox: small F1 gains on synonym and goodword attacks in binary settings (semantic robustness),\n\nyet substantial drops (\u223c25\u201328%) in multi-class scenarios. Adversarial training consistently enhances robustness, yielding multi-class macro F1 gains exceeding 69% for SVM. Linear TF-IDF models (SVM, Logistic Regression) emerge as optimal architectures, balancing baseline accuracy, interpretability, and adversarial resilience. This work underscores the necessity of explicit adversarial evaluation and continuous monitoring in security-critical email filtering systems.<\/jats:p>","DOI":"10.7148\/2026-0311","type":"proceedings-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:36:46Z","timestamp":1782808606000},"page":"311-320","source":"Crossref","is-referenced-by-count":0,"title":["Spam and phishing detection with adversarial attack robustness analysis using machine learning models"],"prefix":"10.7148","author":[{"given":"Anna","family":"Plichta","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gabriela","family":"Raczka","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"4144","published-online":{"date-parts":[[2026,6,23]]},"event":{"name":"40th ECMS International Conference on Modelling and Simulation"},"container-title":["ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina"],"original-title":[],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:36:56Z","timestamp":1782808616000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.scs-europe.net\/dlib\/2026\/ecms2026acceptedpapers\/0311_secmos_ecms2026_0024.pdf"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,23]]},"references-count":0,"URL":"https:\/\/doi.org\/10.7148\/2026-0311","relation":{},"subject":[],"published":{"date-parts":[[2026,6,23]]}}}